# Project Collection Administrators

Project Collection Administrator is a highly privileged role, and membership should be restricted and regularly reviewed.

Source: https://maester.dev/docs/tests/AZDO.1030

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/sebastianclaesson" title="Sebastian Claesson · Original author"><img src="https://github.com/SebastianClaesson.png" alt="Sebastian Claesson" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/sebastianclaesson">Sebastian Claesson</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Azure DevOps · Users and access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AZDO.1030
```

## Overview

Project Collection Administrator is a highly privileged role, and membership should be restricted and regularly reviewed.

Rationale: Project Collection Administrators (PCAs) have unrestricted control over the Azure DevOps organization or collection. A compromised PCA account or an overly broad roster can lead to:

- Unapproved project creation or deletion
- Policy changes that weaken security
- Uncontrolled access to code, pipelines, and artifacts
- Configuration of billing or extensions that impact cost and service availability
Keeping the PCA group small and audited reduces the blast radius of insider threats and accidental misconfiguration.

#### Remediation action

Restrict membership of the Project Collection Administrators group to only those individuals who absolutely require it. Periodically review the list and remove any stale accounts.

Implement privileged access management (PAM) or just-in-time access workflows so that high-privilege membership is temporary and audited. Use multifactor authentication and strong account hygiene for PCA accounts.

**Results:**
A small, well-managed PCA group reduces the risk of malicious or accidental changes and makes post-incident investigation simpler.

#### Related links

- [Learn - Azure DevOps Permissions](https://learn.microsoft.com/azure/devops/organizations/security/about-permissions?view=azure-devops&tabs=preview-page#permissions)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AZDO.1030 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Users and access |
| Area | Privileged access |
| Resource type | User |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1098.003 Additional Cloud Roles |
| Supports controls | nist-800-53-r5:AC-6(5) |
| PowerShell test | [Test-AzdoProjectCollectionAdministrator](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1030.ps1) |
| Services | AzureDevOps |
| Learn more | [https://learn.microsoft.com/azure/devops/organizations/security/about-permissions?view=azure-devops&tabs=preview-page#permissions](https://learn.microsoft.com/azure/devops/organizations/security/about-permissions?view=azure-devops&tabs=preview-page#permissions) |

</details>

## Source

- Test: [`tests/maester/azure-devops/Test.AZDO.1030.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1030.ps1)
- Documentation: [`tests/maester/azure-devops/Test.AZDO.1030.md`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1030.md)